SB2017103006 - Multiple vulnerabilities in F5 BIG-IP

Description

This security bulletin contains information about 7 secuirty vulnerabilities.

1) Denial of service (CVE-ID: CVE-2017-6159)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the due to the MPTCP option is enabled on a virtual server. A remote attacker can use the MPTCP option of a TCP profile and cause TMM to restart hence temporarily failing to process traffic.

Successful exploitation of the vulnerability results in denial of service.

2) Denial of service (CVE-ID: CVE-2017-6160)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the virtual servers using a Policy Enforcement profile or a Web Acceleration profile due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted HTTP request to cause Traffic Management Microkernel (TMM) to restart and temporarily fail to process traffic.

Successful exploitation of the vulnerability results in denial of service.

3) Resource exhaustion (CVE-ID: CVE-2017-0303)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to an error when removing connections handled by a virtual server with an associated SOCKS profile from the connection table when the connections are finished. A remote attacker can consume all available connection resources and cause the system to be unable to process additional connections.

Successful exploitation of the vulnerability results in denial of service.

4) Security restrictions bypass (CVE-ID: CVE-2017-6157)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists in the virtual servers with a configuration that uses the HTTP Explicit Proxy function and/or a SOCKS profile. A remote attacker can modify BIG-IP system configuration, extract sensitive system files, and/or possible execute arbitrary command on the BIG-IP system.

Successful exploitation of the vulnerability may result in system compromise.

5) Denial of service (CVE-ID: CVE-2017-6163)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists when a virtual server uses the standard configuration of HTTP/2 or SPDY profile with Client SSL profile. A remote attacker can send a large number of connections greater than the advertised limit to disrupt Traffic Management Microkernel (TMM) data plane service.

Successful exploitation of the vulnerability results in denial of service.

6) Resource exhaustion (CVE-ID: CVE-2017-6161)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to a flaw in configuration synchronization (ConfigSync). A remote attacker can bypass the TLS protections on connections to the master control program daemon (MCPD), consume excessive resources and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

7) Improper input validation (CVE-ID: CVE-2017-6162)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in virtual servers configured with a TCP profile due to improper input validation. A remote attacker can send specially crafted TCP traffic to cause the target Traffic Management Microkernel (TMM) to restart.

Successful exploitation of the vulnerability results in denial of service.

Remediation

Install update from vendor's website.

References

• https://support.f5.com/csp/article/K10002335
• https://support.f5.com/csp/article/K19430431
• https://support.f5.com/csp/article/K30201296
• https://support.f5.com/csp/article/K02692210
• https://support.f5.com/csp/article/K22541983
• https://support.f5.com/csp/article/K62279530
• https://support.f5.com/csp/article/K13421245